{"id":"CVE-2023-5631","published":"2023-10-18T15:15:08Z","modified":"2026-06-17T06:48:58Z","title":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","vendor":"Roundcube","product":"Webmail","tier":"core","eol":null,"description":{"text":"Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.","provenance":"source","from":"NVD"},"summary":{"text":"Roundcube Webmail (before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4) contains a stored cross-site scripting flaw in its HTML e-mail handling, specifically in the program/lib/Roundcube/rcube_washtml.php component, which fails to neutralise crafted SVG content. A remote attacker who can send an HTML e-mail containing a malicious SVG document can cause arbitrary JavaScript to load when a user, with low privileges, interacts with the message, such as by opening it.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:23Z"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.76337,"percentile":0.99539,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2023-10-26","dueDate":"2023-11-16","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://roundcube.net/news/2023/10/16/security-update-1.6.4-released, https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15 ;  https://nvd.nist.gov/vuln/detail/CVE-2023-5631","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-10-25","exploitedFirstSeen":"2023-10-25","ransomware":false,"evidence":[{"url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/","date":"2023-10-25"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-10-26"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2024-0217.pdf","date":"2024-02-17"},{"url":"https://www.rewterz.com/rewterz-news/rewterz-threat-alert-russia-linked-winter-vivern-apt-leverages-roundcube-vulnerabilities-to-target-over-80-organizations-active-iocs/","date":"2024-02-20"},{"url":"https://dd80b675424c132b90b3-e48385e382d2e5d17821a5e1d8e4c86b.ssl.cf1.rackcdn.com/external/strategic-analysis-svg-files-abused-in-emerging-campaigns-1.pdf","date":"2024-03-07"},{"url":"https://cofense.com/blog/svg-files-abused-in-emerging-campaigns/","date":"2024-03-13"},{"url":"https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q4-2023-q1-2024.pdf","date":"2024-05-14"},{"url":"https://labs.withsecure.com/publications/mass-exploitation-the-vulnerable-edge-of-enterprise-security","date":"2024-06-12"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2023/11/01/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/01/3","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/17/2","tags":["Mailing List","Third Party Advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079","tags":["Mailing List","Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/issues/9168","tags":["Exploit","Issue Tracking"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.4.15","tags":["Release Notes"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.5","tags":["Release Notes"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.4","tags":["Release Notes"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/","tags":["Mailing List"]},{"url":"https://roundcube.net/news/2023/10/16/security-update-1.6.4-released","tags":["Release Notes"]},{"url":"https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15","tags":["Release Notes"]},{"url":"https://www.debian.org/security/2023/dsa-5531","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/01/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/01/3","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/17/2","tags":["Mailing List","Third Party Advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079","tags":["Mailing List","Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/issues/9168","tags":["Exploit","Issue Tracking"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.4.15","tags":["Release Notes"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.5","tags":["Release Notes"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.4","tags":["Release Notes"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/","tags":["Mailing List"]},{"url":"https://roundcube.net/news/2023/10/16/security-update-1.6.4-released","tags":["Release Notes"]},{"url":"https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15","tags":["Release Notes"]},{"url":"https://www.debian.org/security/2023/dsa-5531","tags":["Mailing List"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5631","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.  \n\nIn recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.\n\nThe checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser.","confidence":"high"},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.  \n\nIn recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.\n\nThe checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser.","confidence":"high"},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.  \n\nIn recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.\n\nThe checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-57924","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57924","exploited":true,"exploitedSince":"2023-10-26","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://github.com/roundcube/roundcubemail/issues/9168"],"flow":[{"stage":"exploitation","techniques":["T1204.001"],"provenance":"source"},{"stage":"primary","techniques":["T1059.007"],"provenance":"source"},{"stage":"secondary","techniques":["T1041"],"provenance":"source"}],"timeline":[{"date":"2023-10-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5631","provenance":"source"},{"date":"2023-10-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/","provenance":"source"},{"date":"2023-10-26","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-10-26","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57924","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":8},"priority":{"score":63.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1103 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9954"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.78,"detail":"base score 5.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-roundcube-webmail-cwe-79"}}